UBUNTU-CVE-2026-89157: High severity ubuntu/pcre2 vulnerability
Published Sep 11, 2026
·Updated
PCRE2 before 10.48, on 32-bit platforms, has a pcre2patternconvert out-of-bounds write when an attacker can provide a large pattern.
Affected Software
6 affected components
ubuntu/pcre2*
ubuntu/pcre2*
ubuntu/pcre2*
ubuntu/pcre2*
ubuntu/pcre2*
ubuntu/pcre2*
Event History
Sep 11, 2026
CVE Published
via OSV·04:18 AM
Data Sourced
via OSV·04:18 AM
DescriptionSeverityAffected Software
Frequently Asked Questions
1
Which systems are exposed to this issue?
The issue affects PCRE2 versions before 10.48 running on 32-bit platforms. The affected Ubuntu software package is pcre2.
2
What does an attacker need to exploit it?
An attacker must be able to supply a large pattern that is processed through pcre2_pattern_convert. The vector is local and the attack complexity is high; no privileges or user interaction are required.
3
What is the potential impact?
Successful exploitation can cause an out-of-bounds write. The reported impact includes high integrity impact and low availability impact, with no confidentiality impact.